Whitelist users, IPs and user agents
Updated September 13, 2026
The whitelist settings let specific visitors bypass the reCAPTCHA check entirely. They live under Advanced Settings at Settings › reCAPTCHA WooCommerce, and there are three of them: logged-in users, IP addresses, and user agents.
Each one weakens your spam protection in exchange for convenience, so reach for them only when you have a specific problem to solve.
Whitelist logged-in users
Tick Whitelist logged-in users to skip the reCAPTCHA check for anyone with an active session, on every protected form rather than just the checkout.
This is the broadest of the three and usually the safest, because an account is at least some evidence of a real customer. If you only want the exemption on the checkout page, use Guest Checkout Only instead.
Whitelist IP addresses
Enter one IP address per line in Whitelisted IP Addresses. Visitors from those addresses skip the check. Wildcards and CIDR ranges are not supported, so each address must be written out in full.
The plugin warns about this directly in the settings screen, and the warning is worth taking seriously: an attacker who learns a whitelisted address may be able to spoof it and bypass reCAPTCHA completely. Keep the list short, use it for fixed office or warehouse addresses rather than anything shared, and remove entries when they are no longer needed.
Residential connections usually have dynamic addresses that change periodically, so an entry that works today may silently stop matching later.
Whitelist user agents
Enter one User-Agent substring per line in Whitelisted User Agents. Any request whose User-Agent header contains one of those substrings skips the check.
Because it matches on a substring, a short entry can match far more traffic than you intended. An entry of Mac would exempt most Apple visitors. Use the longest distinctive string you can.
This is the weakest of the three controls. A User-Agent header is chosen by the client and can be set to any value, so anyone who learns a whitelisted string can bypass reCAPTCHA by sending it. It suits an internal monitoring or testing tool with a distinctive agent string, and little else.
Set a custom failure message
The Custom Failed Verification Message field in the same section replaces the wording customers see when verification fails. Leave it blank to keep the default, “Please complete the reCAPTCHA to verify that you are not a robot.”
A custom message is useful if your store’s tone differs from the default, or if you want to tell customers what to do next when they get stuck.